Skip to content

Container Scanning: Provide correct remediation guidance for language finding found in a std lib

Current Behavior

When CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN is set to false, Container Scanning detects Go stdlib vulnerabilities in binaries but provides limited information:

  • Only shows vulnerable package as stdlib@<version>
  • Location only references the image path
  • No binary path information
  • No clear remediation steps

This behavior happens for other languages that have vulnerabilities in their stdlib too.

Expected Behavior

Container Scanning should:

  1. Identify the specific path of the affected binary
  2. Clearly indicate that the vulnerability is in the Go stdlib
  3. Provide explicit remediation guidance, specifically mentioning that rebuilding the binary with a newer version of Go is required

Impact

Users cannot effectively locate and remediate Go stdlib vulnerabilities due to insufficient information in the scan results.


Description was generated using AI

Edited by 🤖 GitLab Bot 🤖